is there any way to enable SSL on the grpc endedpoints? I am looking at IaP, but I am wondering if ...

hallowed-dog-74273

02/08/2024, 10:00 PM

is there any way to enable SSL on the grpc endedpoints? I am looking at IaP, but I am wondering if its really necessary to run an entire service mesh and proxys to handle ssl instead of just having flyte admin handle ssl https://github.com/flyteorg/flytekit/tree/master/plugins/flytekit-identity-aware-proxy#configuring-your-flyte-deployment-to-use-iap

tall-lock-23197

02/12/2024, 4:31 PM

cc @average-finland-92144

average-finland-92144

02/12/2024, 4:32 PM

👍 1

hallowed-dog-74273

02/12/2024, 5:28 PM

actually there is a bit more to this: So the admin grpc client allows for settings custom ca certificate: https://github.com/flyteorg/flyte/blob/55a67f23f5d8e44bc7d70f738b0fafe954e0bf94/flyteidl/clients/go/admin/client.go#L138 but the admin http client does not: https://github.com/flyteorg/flyte/blob/55a67f23f5d8e44bc7d70f738b0fafe954e0bf94/flyteidl/clients/go/admin/auth_interceptor.go#L103 I think there is a way around this be mounting the custom CA cert, and installing the CA in the docker container os. If it was possible to get this in code, and in the admin config map, this wouldn't be require and IaP would work with SSL withouth a proxy

hallowed-dog-74273

02/12/2024, 5:30 PM

Copy code

config := &tls.Config{
		InsecureSkipVerify: *insecure,
		RootCAs:            rootCAs,
}
tr := &http.Transport{TLSClientConfig: config}

average-finland-92144

02/12/2024, 5:49 PM

this wouldn't be require and IaP would work with SSL withouth a proxy

that'd be great. Would you like to contribute?

hallowed-dog-74273

02/12/2024, 6:44 PM

yeah sure. I was planning on testing this this week. i can just create a pr

gratitude thank you 1

🙌🏽 1

11 Views

Flyte

Flyte enables production-grade orchestration for machine learning workflows and data processing created to accelerate local workflows to production.